GSEC Linux Fundamentals — All Questions With Answers

Question 1

You are auditing a Linux server and need to determine which group a user belongs to. Which command will list the groups for the current user?

Accepted Answer

id. The 'groups' command is the standard Linux utility to display all group memberships for a specified user or the current account. Group membership determines access rights to files and services. Improper group assignments can lead to privilege escalation or unauthorized data access, making verification of these permissions a key component of regular security audits and hardening efforts.

Answer

whoami

Answer

ls -g

Answer

cat /etc/passwd

Question 2

Refer to the exhibit. The user is logged in as a standard user and attempts to view the /etc/shadow file using 'sudo'. Why does the command still result in a 'Permission denied' error?

Accepted Answer

The current user is not listed in the /etc/sudoers file.. The user is running 'sudo cat /etc/shadow', which should work if the user has sudo privileges. However, the shell interprets the redirection if the command was written differently, or more likely, the user is not in the 'sudoers' file. In this specific exhibit, the command is 'sudo cat', implying the shell executes cat with root privileges, but if the user lacks sudo rights, access to the file is blocked by the OS.

Answer

The /etc/shadow file is immutable and cannot be read even by root.

Answer

The cat command does not have sufficient permissions to open protected files.

Answer

The /etc/shadow file is encrypted and cannot be viewed as plain text.

Question 3

An administrator wants to search for specific files within the system to identify potential data exfiltration or unauthorized files. Which THREE commands are effective for locating files based on criteria like name, type, or modification time?

Accepted Answer

find / -name 'secret.txt'. Efficiently locating files is crucial for security forensics and system maintenance. The 'find' utility is the most powerful tool for granular searches based on metadata. 'locate' provides a faster, index-based search for names. 'which' is essential for finding executable paths in the system's PATH variable. Mastering these tools enables admins to quickly audit system integrity and track down hidden or misplaced malicious binaries or sensitive data during a security incident.

Answer

which secret.txt

Answer

grep -r 'secret' /

Question 4

A security analyst is reviewing a Linux server that was recently compromised. The analyst needs to determine which user accounts have UID 0 and therefore possess root-equivalent privileges. Which command will list all accounts with UID 0?

Accepted Answer

awk -F: '$3 == 0 {print $1}' /etc/passwd. The correct approach parses /etc/passwd, where each line represents a user account and the third colon-delimited field is the UID. Filtering for UID 0 reveals all accounts with root-equivalent privileges, which is essential for detecting unauthorized backdoor accounts after a compromise. Other commands either search the wrong field, omit usernames, or target the wrong file entirely.

Answer

cat /etc/shadow | awk -F: '$3 == 0 {print $1}'

Answer

cut -d: -f3 /etc/passwd | sort -u

Answer

grep ':0:' /etc/passwd

Question 5

A security analyst notices repeated failed SSH login attempts for the account 'deploy' on a production Linux server. The analyst wants to inspect the failed authentication records and the source IP addresses of those attempts. Which file should the analyst review?

Accepted Answer

/var/log/auth.log. Failed SSH authentication attempts are logged by sshd through PAM into the system's authentication log. On Debian and Ubuntu systems this is /var/log/auth.log, which records timestamps, usernames, and source IP addresses. Reviewing this file lets the analyst identify brute-force patterns and block offending addresses. The other files either store unrelated data or are distribution-specific alternatives.

Answer

/var/log/secure

Answer

/etc/shadow

Answer

/var/log/syslog

Question 6

A security administrator needs to grant a contractor temporary access to a sensitive directory '/projects/secret'. The contractor must be able to read and write files but must not be able to change permissions or delete the directory itself. The contractor is already a member of the group 'contractors'. Which command should the administrator use to set the directory's permissions accordingly?

Accepted Answer

chmod 2770 /projects/secret. The administrator needs to provide read and write access to the 'contractors' group while preventing others from accessing the directory. Mode 2770 achieves this by granting rwx to owner and group, no access to others, and setting the setgid bit so new files inherit the group. The setgid bit also helps maintain group ownership for collaboration. Other modes either grant excessive permissions or lack necessary write access.

Answer

chmod 1777 /projects/secret

Answer

chmod 2755 /projects/secret

Answer

chmod 0770 /projects/secret

Question 7

A security administrator is configuring a Linux server to meet security benchmarks. The administrator needs to ensure that only authorized users can execute the 'passwd' command to change their own passwords, while preventing them from changing other users' passwords. Which TWO commands or configurations should the administrator use to verify and enforce this? (Choose two.)

Accepted Answer

Check the permissions on /usr/bin/passwd using ls -l /usr/bin/passwd. To ensure that users can change only their own passwords, the administrator should verify the setuid permissions on /usr/bin/passwd and review the PAM configuration in /etc/pam.d/passwd. These steps confirm that the passwd command runs with necessary privileges and that PAM enforces proper restrictions. Other actions like setting immutable attributes or adding users to the shadow group would either break functionality or weaken security.

Answer

Use the command chmod u+s /usr/bin/passwd to set the setuid bit

Answer

Add all users to the 'shadow' group to allow password changes

Answer

Set the immutable attribute on /etc/passwd using chattr +i /etc/passwd

Question 8

A security engineer is performing a forensic review of a Linux server and finds that a file named 'evidence.tar.gz' was created in a shared directory. The engineer needs to preserve the original file's timestamps while making a byte-for-byte working copy to analyze on a separate system. Which command should the engineer use to create the copy while retaining the original access, modification, and change times?

Accepted Answer

cp -a evidence.tar.gz /mnt/analysis/. The archive flag for cp is designed to preserve as much file metadata as possible, including permissions, ownership, timestamps, and extended attributes. In a forensic duplication scenario, maintaining the original timestamps is crucial for timeline analysis and evidentiary integrity. While the change time cannot be perfectly preserved by any user-space copy, the archive flag is the standard method to retain the access and modification times, which are the primary timestamps used in file system forensics. Other options either do not preserve timestamps or create a different type of artifact.

Answer

cp --preserve=all evidence.tar.gz /mnt/analysis/

Answer

tar -cvf /mnt/analysis/evidence.tar.gz evidence.tar.gz

Answer

rsync -aHAX evidence.tar.gz /mnt/analysis/

Question 9

A security administrator needs to ensure that a newly created script, 'cleanup.sh', can only be executed by the file owner, while preventing any other users from reading or writing the file. Which command achieves this configuration?

Accepted Answer

chmod 700 cleanup.sh. The chmod command with the octal value 700 applies read, write, and execute permissions exclusively to the owner (7), while setting no permissions for the group (0) and others (0). This follows the principle of least privilege by isolating the script's execution to the authorized user. Restricting access is critical in Linux security to prevent unauthorized execution of potentially sensitive maintenance utilities by standard users or attackers.

Answer

chmod 777 cleanup.sh

Answer

chmod 755 cleanup.sh

Answer

chmod 600 cleanup.sh

Question 10

Refer to the exhibit. A user attempts to delete a file located inside '/opt/backup', but the operation fails with a 'Permission denied' error. Given the directory permissions shown, what is the most likely cause?

Accepted Answer

The user lacks write permission on the /opt/backup directory.. The directory permissions 'drwxr-xr-x' indicate that the owner (root) has full control, while others have read and execute access. However, because the user is neither root nor the directory owner, they lack write permission (w) on the parent directory. In Linux, deleting a file requires write and execute permissions on the directory containing it, not just the file itself. This mechanism protects directory integrity from unauthorized modifications by non-privileged users.

Answer

The user lacks the execute permission on the /opt/backup directory.

Answer

The file inside the directory is owned by root and is immutable.

Answer

The user does not have the 'sudo' command available in their path.

Question 11

An administrator is reviewing system logs to identify potential unauthorized access attempts. Which TWO commands are commonly used to view the last few lines of a log file in real-time?

Accepted Answer

tail -f /var/log/auth.log. Monitoring logs in real-time is a fundamental skill for GSEC professionals to detect ongoing attacks or system errors. The 'tail -f' command is the standard utility for following a file's growth. Alternatively, 'less +F' offers a more robust interface that allows the admin to toggle between real-time monitoring and static analysis, providing better flexibility when investigating complex log entries during an active incident response scenario.

Answer

head -n 20 /var/log/auth.log

Answer

cat /var/log/auth.log | grep -v 'accepted'

Answer

more /var/log/auth.log

Question 12

A Linux administrator needs to identify which processes are currently consuming the most CPU resources. Which command provides an interactive, real-time view of system performance and process activity?

Accepted Answer

top. The 'top' command (or its modern alternative 'htop') is the primary utility for real-time monitoring of system resources, including CPU, memory, and running tasks. Understanding how to interpret and interact with these utilities is vital for identifying rogue processes or system bottlenecks that could indicate a malware infection or a resource-exhaustion attack, allowing administrators to terminate suspicious processes immediately using built-in command signals.

Answer

ps aux

Answer

ls -l /proc

Answer

df -h

Question 13

A security analyst needs to determine which network ports are currently listening for incoming connections on a Linux server. Which command is best suited for this task?

Accepted Answer

ss -tulpn. Identifying open ports is a critical step in reducing the attack surface of a Linux server. The 'ss' (socket statistics) command is the modern, high-performance replacement for the deprecated 'netstat'. It provides detailed information about active connections, listening ports, and the associated process IDs, helping administrators quickly spot unauthorized services that might serve as entry points for malicious actors.

Answer

ifconfig -a

Answer

ping -c 5 localhost

Answer

dig @localhost

Question 14

A security analyst is reviewing a compromised Linux web server. The attacker escalated to root and then ran a script that unlinked the file /var/log/auth.log to hide their tracks. The analyst runs `lsof | grep auth.log` and sees the file is still open by the rsyslogd process, but `ls /var/log/auth.log` reports that the file does not exist. Which of the following best explains why the file content is still accessible through the open file descriptor?

Accepted Answer

The Linux kernel maintains the inode and data blocks until the last open file descriptor referencing the inode is closed, even after the directory entry is removed.. When a file is unlinked on Linux, the directory entry is removed but the inode persists as long as a process holds an open file descriptor. rsyslogd keeps auth.log open for writing, so the kernel cannot free the inode or data blocks. The analyst can recover the contents via /proc//fd/, even though the pathname no longer resolves. Restarting rsyslogd would close the descriptor and finally reclaim the inode.

Answer

The rsyslogd process has the file memory-mapped with mmap, so the page cache keeps a copy that ls can still resolve by inode lookup.

Answer

The file was moved to a hidden directory by the attacker, and lsof is resolving the path from the process's current working directory rather than the real inode.

Answer

The ext4 filesystem journals file deletions, and lsof reads the journal to reconstruct the file contents until the journal is overwritten by subsequent writes.

Question 15

A Linux server has the setuid bit set on /usr/bin/passwd. A security engineer notices that a custom binary /opt/tools/backup_tool also has the setuid bit set and is owned by root. The engineer wants to determine whether executing backup_tool will run with root privileges regardless of which user invokes it. Which of the following is the most accurate statement about how the setuid bit affects process credentials on Linux?

Accepted Answer

The process runs with the effective UID of the file owner, but the real UID remains that of the invoking user, and the saved set-user-ID is set to the file owner's UID.. Executing a setuid binary causes the kernel to set the process's effective UID to the file owner's UID while preserving the real UID of the invoking user. The saved set-user-ID is also set to the file owner's UID, which lets the program temporarily drop and reacquire elevated privileges. This mechanism is why setuid root binaries are high-value targets: any vulnerability in backup_tool could yield root-level access to an unprivileged attacker.

Answer

The process runs with the effective UID of the file owner only if the binary is also executable by the invoking user; otherwise the kernel silently falls back to the invoking user's UID.

Answer

The setuid bit is ignored on Linux unless the filesystem is mounted with the suid option, so the behavior depends entirely on the mount options of the filesystem holding the binary.

Answer

The process runs with the real UID, effective UID, and saved set-user-ID all set to the file owner's UID, so the invoking user's identity is completely lost to the kernel.

Question 16

A junior administrator needs to determine the default gateway configured on a Linux server to troubleshoot outbound connectivity. Which command will display the routing table and show the default route?

Accepted Answer

ip route show. To view the default gateway, the administrator should inspect the routing table. The 'ip route show' command outputs all routes, including the default route that specifies the gateway via which packets are sent when no other route matches. Interface configuration and socket statistics tools do not expose routing information, so they cannot answer the question.

Answer

netstat -tuln

Answer

ss -s

Answer

ifconfig -a

Question 17

A security administrator is hardening a Linux web server. The administrator needs to ensure that the Apache service, which runs as the user 'www-data', cannot be used to escalate privileges if compromised. Which file should the administrator check to verify that 'www-data' does not have a valid login shell?

Accepted Answer

/etc/passwd. The login shell for a user is stored in the seventh field of /etc/passwd. Service accounts like 'www-data' should have a non-interactive shell such as /usr/sbin/nologin to prevent attackers from obtaining a shell if the service is compromised. Other files contain password hashes, group data, or sudo rules, but none store the login shell assignment.

Answer

/etc/sudoers

Answer

/etc/group

Answer

/etc/shadow

Question 18

A security analyst is investigating a suspicious file on a Linux server. The analyst wants to determine the file's inode number, permissions, owner, group, size, and last modification time without modifying the file. Which command should the analyst use?

Accepted Answer

stat filename. The stat command is designed to display comprehensive file metadata, including the inode number, permissions, ownership, size, and timestamps. Unlike ls, it includes the inode number, which is crucial for forensic analysis. Other commands like file and du provide limited information and do not meet the requirement for a complete metadata overview.

Answer

file filename

Answer

du -h filename

Answer

ls -l filename

Question 19

A security analyst is investigating a compromised Linux server and wants to examine the environment variables of a running process with PID 1234 to identify potential injected malicious variables. Which command will display the environment of that specific process?

Accepted Answer

cat /proc/1234/environ. To inspect the environment of a running process, the analyst can read /proc/PID/environ. This pseudo-file contains the environment variables as a null-delimited string, reflecting the process's initial environment. Tools like ps and lsof provide other process details but not environment. The env command only shows the current shell's environment. Thus, accessing /proc/1234/environ is the correct approach.

Answer

ps aux | grep 1234

Answer

env

Answer

lsof -p 1234

Question 20

A security analyst is examining a Linux system for signs of compromise. The analyst notices that a suspicious process is running with a parent process ID (PPID) of 1. Which command will display the process tree, showing parent-child relationships, to help identify how the process was launched?

Accepted Answer

pstree -p. The pstree -p command provides a visual tree of processes with PIDs, making it straightforward to trace parent-child relationships. This is particularly useful when investigating a suspicious process whose PPID is 1, as it helps determine whether the process was legitimately started by init or if it was orphaned or injected. Other commands lack the hierarchical view needed for this analysis.

Answer

pgrep -l suspicious

Answer

top -H

Answer

ps -ef

GSEC Linux Fundamentals — All Questions With Answers

You are auditing a Linux server and need to determine which group a user belongs to. Which command will list the groups for the current user?

Refer to the exhibit. The user is logged in as a standard user and attempts to view the /etc/shadow file using 'sudo'. Why does the command still result in a 'Permission denied' error?

Exhibit

An administrator wants to search for specific files within the system to identify potential data exfiltration or unauthorized files. Which THREE commands are effective for locating files based on criteria like name, type, or modification time?

A security analyst is reviewing a Linux server that was recently compromised. The analyst needs to determine which user accounts have UID 0 and therefore possess root-equivalent privileges. Which command will list all accounts with UID 0?

A security analyst notices repeated failed SSH login attempts for the account 'deploy' on a production Linux server. The analyst wants to inspect the failed authentication records and the source IP addresses of those attempts. Which file should the analyst review?

A security administrator needs to ensure that a newly created script, 'cleanup.sh', can only be executed by the file owner, while preventing any other users from reading or writing the file. Which command achieves this configuration?

Refer to the exhibit. A user attempts to delete a file located inside '/opt/backup', but the operation fails with a 'Permission denied' error. Given the directory permissions shown, what is the most likely cause?

Exhibit

An administrator is reviewing system logs to identify potential unauthorized access attempts. Which TWO commands are commonly used to view the last few lines of a log file in real-time?

A Linux administrator needs to identify which processes are currently consuming the most CPU resources. Which command provides an interactive, real-time view of system performance and process activity?

A security analyst needs to determine which network ports are currently listening for incoming connections on a Linux server. Which command is best suited for this task?

A junior administrator needs to determine the default gateway configured on a Linux server to troubleshoot outbound connectivity. Which command will display the routing table and show the default route?

A security analyst is investigating a suspicious file on a Linux server. The analyst wants to determine the file's inode number, permissions, owner, group, size, and last modification time without modifying the file. Which command should the analyst use?

A security analyst is investigating a compromised Linux server and wants to examine the environment variables of a running process with PID 1234 to identify potential injected malicious variables. Which command will display the environment of that specific process?

A security analyst is examining a Linux system for signs of compromise. The analyst notices that a suspicious process is running with a parent process ID (PPID) of 1. Which command will display the process tree, showing parent-child relationships, to help identify how the process was launched?

A security administrator is hardening a Linux server and needs to ensure that user passwords meet complexity requirements and are stored securely. Which two actions should the administrator take? (Choose two.)

GSEC Linux Fundamentals — All Questions With Answers

You are auditing a Linux server and need to determine which group a user belongs to. Which command will list the groups for the current user?

Refer to the exhibit. The user is logged in as a standard user and attempts to view the /etc/shadow file using 'sudo'. Why does the command still result in a 'Permission denied' error?

Exhibit

An administrator wants to search for specific files within the system to identify potential data exfiltration or unauthorized files. Which THREE commands are effective for locating files based on criteria like name, type, or modification time?

A security analyst is reviewing a Linux server that was recently compromised. The analyst needs to determine which user accounts have UID 0 and therefore possess root-equivalent privileges. Which command will list all accounts with UID 0?

A security analyst notices repeated failed SSH login attempts for the account 'deploy' on a production Linux server. The analyst wants to inspect the failed authentication records and the source IP addresses of those attempts. Which file should the analyst review?

A security administrator needs to ensure that a newly created script, 'cleanup.sh', can only be executed by the file owner, while preventing any other users from reading or writing the file. Which command achieves this configuration?

Refer to the exhibit. A user attempts to delete a file located inside '/opt/backup', but the operation fails with a 'Permission denied' error. Given the directory permissions shown, what is the most likely cause?

Exhibit

An administrator is reviewing system logs to identify potential unauthorized access attempts. Which TWO commands are commonly used to view the last few lines of a log file in real-time?

A Linux administrator needs to identify which processes are currently consuming the most CPU resources. Which command provides an interactive, real-time view of system performance and process activity?

A security analyst needs to determine which network ports are currently listening for incoming connections on a Linux server. Which command is best suited for this task?

A junior administrator needs to determine the default gateway configured on a Linux server to troubleshoot outbound connectivity. Which command will display the routing table and show the default route?

A security analyst is investigating a suspicious file on a Linux server. The analyst wants to determine the file's inode number, permissions, owner, group, size, and last modification time without modifying the file. Which command should the analyst use?

A security analyst is investigating a compromised Linux server and wants to examine the environment variables of a running process with PID 1234 to identify potential injected malicious variables. Which command will display the environment of that specific process?

A security analyst is examining a Linux system for signs of compromise. The analyst notices that a suspicious process is running with a parent process ID (PPID) of 1. Which command will display the process tree, showing parent-child relationships, to help identify how the process was launched?

A security administrator is hardening a Linux server and needs to ensure that user passwords meet complexity requirements and are stored securely. Which two actions should the administrator take? (Choose two.)